3600Third-party advisory
http://securityreason.com/securityalert/3600 CVE-2008-0736
CandyPress eCommerce suite 4.1.1.26 - Multiple Vulnerabilities
Record summary
CVE-2008-0736 has a selected CVSS score of 5.0; EIP currently links 1 catalogued exploit.
Description
admin/SA_shipFedExMeter.asp in CandyPress (CP) 4.1.1.26, and possibly other 4.x and 3.x versions, allows remote attackers to obtain the path via a certain value of the FedExAccount parameter.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBCandyPress eCommerce suite 4.1.1.26 - Multiple VulnerabilitiesExploitDB exploitby BugReport.IRNot analyzed1 file
References
8candypress.com
http://www.candypress.com/CPforum/forum_posts.asp?TID=10630&PN=1 20080125 [CandyPress] eCommerce suite (SQL Injection + XSS + Path Disclosure)mailing list
http://www.securityfocus.com/archive/1/487058/100/0/threaded 27454vdb entry
http://www.securityfocus.com/bid/27454 ADV-2008-0314vdb entry
http://www.vupen.com/english/advisories/2008/0314 ecommerce-sashipfedexmeter-path-disclosure(39941)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/39941 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2008-0736 4988exploit
https://www.exploit-db.com/exploits/4988